CVE-2025-66154: 
WordPress vulnerability analysis and mitigation

CVE-2025-66154 is a Missing Authorization vulnerability in the Couponer for Elementor WordPress plugin developed by merkulove. It allows authenticated low-privileged users to exploit incorrectly configured access control security levels, affecting all versions from n/a through 1.1.7. The vulnerability was published on December 31, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality. An attacker with a low-privileged WordPress account (e.g., subscriber or contributor) can send network requests to plugin endpoints that lack proper capability checks, enabling unauthorized actions. No user interaction is required, and attack complexity is low, making exploitation straightforward for any authenticated user (Feedly).

Successful exploitation allows authenticated attackers to modify coupon data (integrity impact) and potentially disrupt plugin availability (availability impact). Confidentiality is not impacted, as no sensitive data exposure is indicated. The scope is limited to the affected WordPress installation, with no evidence of lateral movement potential beyond the plugin's functionality (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-66154. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid (low-privileged) WordPress account on the target site (Feedly).

Users should update the Couponer for Elementor plugin to a version beyond 1.1.7 if a patched release is available from the plugin developer (merkulove). If no patch is yet available, site administrators should consider deactivating the plugin until a fix is released, or restricting access to WordPress sites to trusted users only. Monitoring WordPress user activity logs for unexpected coupon modifications may help detect abuse (Patchstack).